Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Qualys Web Application Scanning review

#15 of 26 in Dynamic Application Security Testing SoftwareWebsite Security SoftwareWeb Application Security Scanners

A broad DAST service for authenticated web and API testing in Qualys environments.

8.0/10Editor score
Visit Qualys
Qualys Web Application Scanning8.0 Visit Qualys

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Qualys Web Application Scanning is a cloud-based dynamic application security testing service for organizations assessing web applications and APIs. It combines automated crawling with fault-injection vulnerability testing, authenticated scanning, workflow support, reporting, and dashboards. The service fits security and development teams that need to scan externally accessible applications through Qualys Security Operations Centers or assess internal applications through scanner appliances. Its web and API coverage also suits organizations with both browser-based applications and API-driven services.

Pricing follows a contact-sales model, with no free plan listed. Qualys positions WAS around a wide testing scope rather than a single scanning method: authenticated scans support form, HTTP Basic, and Digest authentication, while Selenium script playback handles complex workflows and login authentication. API testing accepts Swagger definitions, Postman collections, and Burp captures, and includes OWASP API Top 10 coverage plus OpenAPI/Swagger compliance verification. These capabilities make the product a fit for teams whose applications require authenticated paths or structured API assessment, rather than only unauthenticated perimeter checks.

For delivery workflows, GitHub Actions integration provides build pass/fail criteria and JSON artifacts, while the Qualys WAS API supports automation. Dashboards provide asset and vulnerability visualization, and deployment can span Qualys cloud scanners and internal scanner appliances. The product is strongest for large organizations already using Qualys and needing web, API, authenticated, and CI/CD coverage in one service. Teams seeking transparent self-service pricing, a free plan, or a broader set of named integrations should consider alternatives built around those requirements instead.

Qualys Web Application Scanning pros and cons

  • Where it wins
    • Authenticated scanning supports complex workflows and login methods.
    • REST API testing covers Swagger, Postman, Burp, and OWASP API risks.
    • GitHub Actions adds build pass/fail criteria and JSON artifacts.
  • Where it doesn't
    • Pricing is handled through Qualys sales rather than published plans.
    • The named integration options center on GitHub Actions and Qualys APIs.
    • Internal scanning requires scanner appliances instead of cloud scanners alone.

Qualys Web Application Scanning fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update